Managed Detection & Response

Managed detection and response with an agreed operating model.

QuantM managed detection and response (MDR) connects the right security signals to investigation, escalation, and response responsibilities across the environment in scope, for Canadian small and midsize businesses.

Book a 15-minute M365 posture review Back to all services

What is included

Signals connected to people who can act.

QuantM provides 24/7 managed monitoring for the systems included in scope. Response actions, integrations, escalation targets, and approval boundaries are confirmed before service begins.

  1. 01Continuous monitoring

    Coverage, ownership, dependencies, and review expectations are confirmed during the assessment.

  2. 02Human-led triage

    Every escalated alert is reviewed by a senior analyst who decides if it's real before paging you.

  3. 03Active containment

    Isolate endpoints, revoke sessions, and disable accounts the moment we confirm a threat.

  4. 04Guided recovery

    Step-by-step remediation tailored to your stack and a post-incident report within 72 hours.

  5. 05Executive reporting

    MTTR, SLA performance, incidents, and trends written for non-technical stakeholders.

  6. 06Named analyst pod

    A dedicated group of analysts that learns your environment, joins your Slack, and escalates with context.

What is monitored

The signals QuantM watches, and who acts on them.

Coverage is built from the categories of system you run. Each source is confirmed in writing before service starts, so you know what is and is not watched.

Identity
SourcesCloud identity providers and directories
What analysts look forImpossible-travel and anomalous sign-ins, MFA fatigue, risky token use, privileged role changes
Email and collaboration
SourcesBusiness email, chat, and file-sharing suites
What analysts look forInbox-rule abuse, impersonation, malicious attachments and links, unusual external sharing, risky app consents
Endpoints and servers
SourcesEndpoint protection and EDR on laptops and servers
What analysts look forMalware and ransomware behaviour, credential theft, lateral movement, persistence
Cloud and SaaS
SourcesMajor cloud providers and SaaS applications
What analysts look forSuspicious administrative activity, new access keys, exposed storage, unexpected workloads
Logs and SIEM
SourcesExisting SIEM or log platforms, where you have one
What analysts look forCorrelation across the sources above so one event is not judged in isolation

Scope

What MDR covers, and what stays with you.

MDR watches, investigates, and responds. It does not replace the people who administer your systems.

In scope

  • 24/7 monitoring of the sources agreed in scope
  • Alert triage and investigation by a human analyst
  • Escalation to named contacts, with plain-language context
  • Containment actions you have pre-approved, such as isolating an endpoint, revoking sessions, or disabling an account
  • Written incident reporting and recommendations after confirmed events
  • Regular service reviews against the agreed scope

Not included

  • Day-to-day IT support, onboarding, and device administration (available separately under Managed IT)
  • Applying every remediation change in your environment unless it is in the agreed scope
  • Systems and data sources that are not connected or not listed in scope
  • Legal advice, breach notification decisions, and insurer or regulator communication
  • Full forensic investigation or recovery work beyond the agreed response scope

Sample incident timeline

What a Microsoft 365 account compromise looks like under MDR.

An illustrative example, not a client record. Real timing depends on the threat, the sources connected, and the response actions you have approved.

  1. T+0

    Step 1: An employee enters credentials on a phishing page. Seconds later, the attacker signs in from an unfamiliar location and creates a hidden inbox rule to forward replies.

  2. Detection

    Step 2: The sign-in and the new inbox rule are flagged together. Either signal alone can look harmless; together they match a known compromise pattern.

  3. Triage

    Step 3: An analyst reviews the account's recent activity and confirms the sign-in was not the user. QuantM's median MDR triage time is under 5 minutes.

  4. Containment

    Step 4: Under the playbook you pre-approved, the analyst revokes active sessions, forces a password reset, disables the rogue inbox rule, and checks for other accounts the same actor touched.

  5. Notification

    Step 5: Your named contact gets a plain-language message: what happened, what was done, what the user needs to do, and whether any data was accessed.

  6. Follow-up

    Step 6: A written report covers the timeline, root cause, and the controls that would have stopped it, such as conditional access or phishing-resistant MFA.

Pricing

What drives the price of MDR.

QuantM MDR is a predictable monthly fee. It is quoted after a short review of your environment, because a few factors move the number more than anything else.

Users and endpoints
Why it mattersThe number of people, laptops, and servers being monitored sets the baseline volume of work.
Sources in scope
Why it mattersIdentity, email, endpoint, cloud, and SIEM data each add integration and tuning effort.
Tooling you already own
Why it mattersIf you already license a supported EDR or a Microsoft 365 plan with the right security features, those costs are not repeated. If not, tooling can be included.
Response authority
Why it mattersThe more containment you pre-approve, the less time is spent waiting on callbacks, and the more the service is configured to act.
Delivery model
Why it mattersFully managed, co-managed with your IT team, or specialist scope beside your MSP are priced differently.
Reporting and evidence
Why it mattersExecutive reporting and evidence for cyber insurance or client questionnaires add review effort.

Proof

Figures QuantM stands behind.

Median MDR triage time
FigureUnder 5 minutes
What it meansTime from a qualifying alert to an analyst's initial assessment of whether it is real.
Phishing block rate
Figure99.4%
What it meansShare of phishing attempts blocked on QuantM-managed email.

Who this helps

Value for the people accountable for the outcome.

The service starts from the decision each stakeholder needs to make, not from a fixed list of tools.

Owner, COO, or risk leader

When this matters

The business has security tools but cannot confidently explain who investigates alerts, who is contacted, or who approves disruptive response actions.

What changes

Monitoring and investigation connect to an agreed escalation path, business decision owners, and reviewable evidence.

Internal IT lead

When this matters

Security alerts compete with user support, projects, and administration, especially when an event needs deeper investigation.

What changes

QuantM can take the agreed investigation and escalation workload while your team retains business context, administration, and approval authority.

MSP or IT provider

When this matters

The provider owns day-to-day IT but does not want alert investigation and security response to remain an informal add-on.

What changes

QuantM can operate the specialist security scope beside the provider, with handoffs, access, escalation, and client communication agreed in advance.

Delivery model

Fully managed or co-managed. Responsibilities stay clear.

QuantM can take full responsibility for managed IT, cybersecurity, and AI operations, co-manage them with your team, or own a defined specialist scope beside another provider. The engagement documents who owns each function, decision, and escalation.

Fully managed by QuantM

QuantM operates the agreed IT, cybersecurity, and AI services as your managed provider, including the day-to-day responsibilities defined in scope.

Co-managed with your team

QuantM and your internal team divide operational responsibilities based on your people, capabilities, and priorities.

Specialist scope

QuantM owns a defined service beside your MSP or other providers, with explicit handoffs and escalation paths.

Expected outcomes

A response path your team can follow.

The service is designed to improve visibility, investigation, and decision ownership.

  • Monitored systems and signals are explicitly documented
  • Alerts have an investigation and escalation path
  • Response actions and approval boundaries are agreed
  • Findings and service decisions are reviewed with the right owners

How it works

Build coverage from the environment and response plan.

  1. Step 01

    Assess

    Review the current environment, business priority, dependencies, and constraints.

  2. Step 02

    Define

    Agree the scope, responsibilities, access, escalation paths, and expected outputs.

  3. Step 03

    Implement

    Complete the approved changes and connect the service to the people who will operate it.

  4. Step 04

    Review

    Review findings, open decisions, service changes, and the next priority on an agreed cadence.

Related services

Continue building the operating model.

Managed security services (MSSP) beyond MDRSecurity operations centre (SOC) as a serviceVulnerability ManagementFirewall Management

Related guides

Learn how managed detection and response works.

Managed Detection and Response for SMBs: the full guideHow MDR works for small businessesWhy small businesses need MDRMDR vs. antivirus for small business24/7 threat monitoring for SMBsHow MDR helps stop ransomware
FAQ

Common questions, answered.

Questions about scope, ownership, onboarding, and what happens next.

Discuss your situation

Identity, email and collaboration, endpoints and servers, cloud and SaaS, and existing SIEM or log data. The exact list of systems is confirmed in writing before service starts, so you know which sources are and are not covered.

No. QuantM operates the tools you already own where they are supported. If you lack endpoint protection or the right licensing, QuantM can include tooling in the quote.

Both are available. Fully managed means QuantM owns monitoring, investigation, and response end to end. Co-managed means QuantM handles monitoring and investigation while your IT team keeps administration and takes the remediation steps you assign. QuantM can also run MDR beside your existing MSP. Responsibilities, access, and escalation are written down before service begins.

Only what you pre-approve. Typical pre-approved actions are isolating an endpoint, revoking sessions, and disabling a compromised account. Anything more disruptive, such as taking a server offline, goes to your named contact first.

Onboarding takes under 5 hours once access is granted. Sources are connected and monitoring starts in that window, and detections are tuned to your environment as the service runs.

MDR is a predictable monthly fee, quoted after a short review of your environment. The main drivers are user and endpoint count, sources in scope, tooling you already own, how much response authority you pre-approve, and whether service is fully managed or co-managed. The 15-minute Microsoft 365 posture review is the fastest way to get a scoped quote.

An analyst triages the alert, confirms whether it is real, and takes the containment actions you pre-approved. You are notified in plain language with what happened and what to do next, and you receive a written report afterward.

Antivirus and EDR generate alerts and block known threats. MDR adds people who investigate those alerts around the clock, correlate them across identity, email, and endpoints, and act on them. See the full guide linked below for the detail.

Next step

Start with a 15-minute Microsoft 365 posture review.

Review identity, email, sharing, app permissions, and monitoring ownership. Qualified organizations can then validate the workflow through a scoped 30-day trial assessment.

Book a 15-minute M365 posture review